CrowdStrike unveiled Agentic Adversary Emulation, powered by SafeMind, the company's family of purpose-built security models and harnesses, at Fal.Con Europe 2026 in Barcelona on November 4. The new offering red teams a customer's environment like an agentic adversary, chaining vulnerabilities and weaknesses into exploitable paths to an organization's critical assets.
The capability is integrated into the CrowdStrike Falcon platform. It uses autonomous AI to replicate attacker behaviour, identify potential routes into critical systems and assess whether security improvements have successfully closed those routes. It drives prioritized remediation and validates that attack paths are closed.
Red Tempest, SafeMind's offensive model, operates like an autonomous attacker. It is designed to behave like an autonomous attacker, investigating potential weaknesses and attempting to chain them into exploitable attack paths across thousands of potential steps. SafeMind is trained on Falcon sensor telemetry, expert-labeled threat intelligence, and frontline experience from CrowdStrike's analysts and incident responders tracking adversaries and stopping breaches.
CrowdStrike's 2026 Agentic AI Campaign report documented an agent chaining a single vulnerability into cluster-admin access and exfiltrating 726 databases, with no human at the keyboard. Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, said AI-enabled attackers can operate at a speed and scale that conventional security processes struggle to match.
Agentic Adversary Emulation is available in early access for select customers through Project QuiltWorks partners. The company said the system draws on threat intelligence covering more than 290 tracked adversaries.
The launch reflects a shift in cybersecurity toward using AI on defense in the same agentic way attackers are beginning to use it — not just scanning for single vulnerabilities, but testing how a chain of weaknesses could actually be combined to reach an organization's most important assets.
